f3f5c7801f
CI / No Debug Code (pull_request) Successful in 3s
CI / Tests (PHP 8.1) (pull_request) Successful in 43s
CI / Tests (PHP 8.3) (pull_request) Successful in 49s
CI / Tests (PHP 8.2) (pull_request) Successful in 59s
CI / Coding Standards (pull_request) Successful in 1m11s
CI / PHPStan (pull_request) Successful in 1m20s
CI / Build Plugin Zip (pull_request) Has been skipped
Four fixes from a security review pass: - Neutralise CSV formula injection in the payments export: fields with a leading =, +, -, @, tab, or CR (e.g. a hostile student display name) are apostrophe-prefixed in PaymentReport::csvLine() so they open as text in Excel/Google Sheets. Fixes #39. - Sanitise policy bodies with wp_kses_post at output in PolicyEndpoint::index() (the booking JS renders that HTML raw), so a future write path that forgets kses can never become stored XSS. Fixes #40. - Store invite tokens hashed (SHA-256) at rest: a database leak can no longer redeem pending invites. The registration link is shown once, at creation; the pending list shows email/invited date; lookups hash the submitted token. Existing plaintext pending invites must be re-issued. Fixes #41. - Validate availability slot datetimes on both creation paths (REST and admin form) via AvailabilitySlot::normalizeDateTime(): canonical and datetime-local forms normalise to Y-m-d H:i:s, garbage and end <= start are rejected (REST 400) instead of reaching the DATETIME column or throwing inside the weekly-series date arithmetic. Fixes #42. composer test (204 tests, 594 assertions), PHPStan L6, and PHPCS all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
111 lines
5.5 KiB
PHP
111 lines
5.5 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
if (! defined('ABSPATH')) {
|
|
exit;
|
|
}
|
|
|
|
/**
|
|
* @var list<\Unsupervised\Schedular\Auth\Invite> $pendingInvites
|
|
* @var int $registrationPageId
|
|
* @var string $registrationPageUrl
|
|
* @var string $newInviteUrl One-time registration link for a just-created invite.
|
|
*/
|
|
?>
|
|
<div class="wrap">
|
|
<h1><?php esc_html_e('Invites', 'unsupervised-schedular'); ?></h1>
|
|
<p class="description"><?php esc_html_e('Invite a student by email, then send them the registration link. They complete signup and accept any required policies through the [us_student_register] page.', 'unsupervised-schedular'); ?></p>
|
|
|
|
<?php if ($newInviteUrl !== '') : ?>
|
|
<div class="notice notice-success inline">
|
|
<p><?php esc_html_e('Invite created. Copy the registration link now — for security it is not stored and cannot be shown again. To re-send a lost link, revoke the invite and create a new one.', 'unsupervised-schedular'); ?></p>
|
|
<p><input type="text" class="large-text code" readonly value="<?php echo esc_attr($newInviteUrl); ?>" onclick="this.select()"></p>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<h2><?php esc_html_e('Registration Page', 'unsupervised-schedular'); ?></h2>
|
|
<form method="post">
|
|
<?php wp_nonce_field('usc_invite_action'); ?>
|
|
<input type="hidden" name="usc_action" value="set_page">
|
|
<table class="form-table">
|
|
<tr>
|
|
<th><label for="registration_page_id"><?php esc_html_e('Page with the registration form', 'unsupervised-schedular'); ?></label></th>
|
|
<td>
|
|
<?php
|
|
wp_dropdown_pages(
|
|
[
|
|
'name' => 'registration_page_id',
|
|
'id' => 'registration_page_id',
|
|
'selected' => $registrationPageId,
|
|
'show_option_none' => esc_html__('— Select a page —', 'unsupervised-schedular'),
|
|
'option_none_value' => '0',
|
|
]
|
|
);
|
|
?>
|
|
<p class="description"><?php esc_html_e('Choose the page that contains the [us_student_register] shortcode. Invitation links point here.', 'unsupervised-schedular'); ?></p>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
<?php submit_button(esc_html__('Save Page', 'unsupervised-schedular'), 'secondary'); ?>
|
|
</form>
|
|
|
|
<?php if ($registrationPageUrl === '') : ?>
|
|
<div class="notice notice-warning inline"><p><?php esc_html_e('No registration page is set yet — invitation links will fall back to the site home page. Select a page above.', 'unsupervised-schedular'); ?></p></div>
|
|
<?php endif; ?>
|
|
|
|
<h2><?php esc_html_e('Invite a Student', 'unsupervised-schedular'); ?></h2>
|
|
<form method="post">
|
|
<?php wp_nonce_field('usc_invite_action'); ?>
|
|
<input type="hidden" name="usc_action" value="invite">
|
|
<table class="form-table">
|
|
<tr>
|
|
<th><label for="email"><?php esc_html_e('Email', 'unsupervised-schedular'); ?></label></th>
|
|
<td><input type="email" name="email" id="email" class="regular-text" required></td>
|
|
</tr>
|
|
</table>
|
|
<?php submit_button(esc_html__('Generate Invitation Link', 'unsupervised-schedular')); ?>
|
|
</form>
|
|
|
|
<h2><?php esc_html_e('Pending Invites', 'unsupervised-schedular'); ?></h2>
|
|
|
|
<?php if (empty($pendingInvites)) : ?>
|
|
<p><?php esc_html_e('No pending invites.', 'unsupervised-schedular'); ?></p>
|
|
<?php else : ?>
|
|
<table class="wp-list-table widefat fixed striped">
|
|
<thead>
|
|
<tr>
|
|
<th><?php esc_html_e('Email', 'unsupervised-schedular'); ?></th>
|
|
<th><?php esc_html_e('Invited', 'unsupervised-schedular'); ?></th>
|
|
<th><?php esc_html_e('Actions', 'unsupervised-schedular'); ?></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<?php $now = current_time('mysql'); ?>
|
|
<?php foreach ($pendingInvites as $invite) : ?>
|
|
<tr>
|
|
<td>
|
|
<?php echo esc_html($invite->email); ?>
|
|
<?php if ($invite->isExpired($now)) : ?>
|
|
<span class="us-invite-expired" style="color:#b32d2e;">— <?php esc_html_e('expired', 'unsupervised-schedular'); ?></span>
|
|
<?php endif; ?>
|
|
</td>
|
|
<td>
|
|
<?php echo esc_html((string) $invite->createdAt); ?>
|
|
</td>
|
|
<td>
|
|
<form method="post" style="display:inline;">
|
|
<?php wp_nonce_field('usc_invite_action'); ?>
|
|
<input type="hidden" name="usc_action" value="revoke">
|
|
<input type="hidden" name="invite_id" value="<?php echo esc_attr((string) $invite->id); ?>">
|
|
<button type="submit" class="button button-small button-link-delete">
|
|
<?php esc_html_e('Revoke', 'unsupervised-schedular'); ?>
|
|
</button>
|
|
</form>
|
|
</td>
|
|
</tr>
|
|
<?php endforeach; ?>
|
|
</tbody>
|
|
</table>
|
|
<?php endif; ?>
|
|
</div>
|